Skill
SAST Configuration
Sets up Semgrep, CodeQL and SonarQube so the pipeline blocks real findings.
Install
/plugin marketplace add wshobson/agents; /plugin install security-scanning
Triggers on
When security scanning is added to CI or an existing scanner produces too much noise.
- Author
- wshobson
- License
- MIT
Repositoryhttps://github.com/wshobson/agents
A scanner that floods the build with noise gets muted within a week, so the skill spends its effort on tuning: custom rules for the patterns specific to a codebase, quality gates that fail on what matters, and suppression of the false positives that would otherwise train the team to ignore alerts. Running several engines together is treated as a deliberate choice, since their coverage barely overlaps.
Comments(0)
Sign in to comment